EUVD-2026-45375

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...

CVE-2026-15631

Summary (supported by provided sources): The CVE-2026-15631 issue affects @fastify/http-proxy versions 9.4.0 to 11.5.0, where the WebSocket routing logic in WebSocketProxy.findUpstream validates the destination path against the rewrite prefix but relies on the WHATWG URL constructor, which collap...

SUSE-SU-2026:22819-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption...

OPENSUSE-SU-2026:21372-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption...

Denial Of Service (DoS)

websocket-driver is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of variable-length WebSocket frame length headers, which allows an attacker to send an indefinite sequence of high-bit-set bytes 0x80 or above, causing the server to parse an ever-growing intege...

Denial Of Service (DoS)

websocket-driver is vulnerable to Denial Of Service DoS. The vulnerability is due to validating only the compressed message size instead of the decompressed size when using the permessage-deflate extension, which allows an attacker to send highly compressed messages that expand beyond the...

Linux Distros Unpatched Vulnerability : CVE-2026-54464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than...

Linux Distros Unpatched Vulnerability : CVE-2026-54465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a T...

Linux Distros Unpatched Vulnerability : CVE-2026-54490

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket...

Linux Distros Unpatched Vulnerability : CVE-2026-54463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a leng...

Linux Distros Unpatched Vulnerability : CVE-2026-54466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a...

PT-2026-60960

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.4.0 through 11.5.0 Description WebSocket destination paths are not properly validated against the configured rewrite prefix. The WebSocketProxy.findUpstream function resolves destinations using the WHATWG URL...

CVE-2026-54466

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite...

DEBIAN-CVE-2026-54466

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite...

DEBIAN-CVE-2026-54490

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked...

CVE-2026-54490

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked...

CVE-2026-54490

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked...

CVE-2026-54466

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite...

UBUNTU-CVE-2026-54466

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite...

UBUNTU-CVE-2026-54490

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked...